usebruno/bruno · error · Error

Password is required for OAuth2 password credentials flow

Error message

Password is required for OAuth2 password credentials flow

What it means

Thrown by fetchTokenPassword when oauth2Config.password is falsy. The resource-owner password grant requires the user's password to exchange for a token; the helper rejects the call up front rather than sending a malformed request.

Source

Thrown at packages/bruno-requests/src/auth/oauth2-helper.ts:223

    clientId,
    clientSecret,
    username,
    password,
    scope,
    credentialsPlacement = 'basic_auth_header',
    additionalParameters
  } = oauth2Config;

  if (!accessTokenUrl) {
    throw new Error('Access Token URL is required for OAuth2 password credentials flow');
  }

  if (!username) {
    throw new Error('Username is required for OAuth2 password credentials flow');
  }

  if (!password) {
    throw new Error('Password is required for OAuth2 password credentials flow');
  }

  if (!clientId) {
    throw new Error('Client ID is required for OAuth2 password credentials flow');
  }

  const requestConfig: RequestConfig = {
    method: 'POST',
    url: accessTokenUrl,
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
      'Accept': 'application/json'
    },
    data: '',
    responseType: 'arraybuffer'
  };

  const data: PasswordGrantData = {

View on GitHub (pinned to 9bdd81c7bd)

Solutions

Ensure a non-empty password is supplied in the config.
Check the secret source (env var, keychain, prompt) actually returned a value.
Consider migrating away from the password grant — OAuth2.1 deprecates it; use authorization_code or client_credentials instead.

Example fix

// before
const config = { grantType: 'password', accessTokenUrl: url, username: user, clientId: id };

// after
const config = {
  grantType: 'password',
  accessTokenUrl: url,
  username: user,
  password: process.env.USER_PASSWORD,
  clientId: id
};

Defensive patterns

Strategy: validation

Validate before calling

if (!config.password) throw new Error('Password required for password grant');

Type guard

function hasPassword(c) { return typeof c.password === 'string' && c.password.length > 0; }

Try / catch

try { await getOAuth2AccessToken(config, tokenStore); }
catch (e) { if (e.message.includes('Password is required')) { /* re-prompt */ } else throw e; }

Prevention

Never log or echo the password while validating its presence.
Prefer migrating to authorization_code flow; the password grant is deprecated in OAuth2.1.
Source the password from a secure prompt or secret manager, not a plain config file.

When it happens

Trigger: getOAuth2AccessToken called with grantType='password' and a username, but the password field empty/undefined.

Common situations: Password field left blank in a login flow; secret loader returned undefined for the password; password was accidentally trimmed/emptied by input sanitization.

Related errors

AI-assisted analysis of usebruno/bruno@9bdd81c7bd (2026-08-13). Data as JSON: /api/errors/53719bce6a5132ec. Report an issue: GitHub.